Ensure 'Security Policy' denying any/all traffic to/from IP addresses on Trusted Threat Intelligence Sources Exists

ÉlevéeNiveau 1Automatiséepaloalto

Description

Create a pair of security rules at the top of the security policies ruleset to block traffic to and from IP addresses known to be malicious. Note: This recommendation (as written) requires a Palo Alto Networks "Threat Prevention License". Third Party and Open Source Threat Intelligence Feeds can also be used for this purpose. PASS requires security rules using the panw-known-ip-list EDL as source and as destination; confirm the rules also list panw-highrisk-ip-list, panw-torexit-ip-list and panw-bulletproof-ip-list and use action deny/drop. Audited against the PAN-OS running configuration in set format: run 'set cli config-output-format set', then 'configure' and 'show' (or 'show config running') and save the full output.

Méthode de vérification

Méthode d'audit: Motif de configuration

Motif: (?m)(?:^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?rulebase security rules (?:"[^"\n]*"|\S+) destination [^\n]*panw-known-ip-list(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?rulebase security rules (?:"[^"\n]*"|\S+) source [^\n]*panw-known-ip-list|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?rulebase security rules (?:"[^"\n]*"|\S+) source [^\n]*panw-known-ip-list(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?rulebase security rules (?:"[^"\n]*"|\S+) destination [^\n]*panw-known-ip-list)

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

configure set rulebase security rules "Deny to Malicious IP" from any to any source any destination [ panw-known-ip-list panw-highrisk-ip-list panw-torexit-ip-list panw-bulletproof-ip-list ] application any service any action deny set rulebase security rules "Deny from Malicious IP" from any to any source [ panw-known-ip-list panw-highrisk-ip-list panw-torexit-ip-list panw-bulletproof-ip-list ] destination any application any service any action deny commit # CIS guidance: Navigate to Policies > Security Create a Security Policy similar to: General tab: Name set to Deny to Malicious IP Source tab: Source Zone set to Any, Destination tab: Destination Zone set to Any, Destination Address set to Palo Alto Networks - Known malicious IP addresses,Palo Alto Networks - High risk IP addresses, Palo Alto Networks - Tor exit IP addresses, Palo Alto Networks - Bulletproof IP addresses Application tab: Application set to Any Service/URL Category tab: Service set to Any Actions tab: Action set to Block, Profile Type set to None Create a Security Policy similar to: General tab: Name set to Deny from Malicious IP Source tab: Source Zone set to Any, Source Address set to Palo Alto Networks - Known malicious IP addresses,Palo Alto Networks - High risk IP addresses, Palo Alto Networks - Tor exit IP addresses, Palo Alto Networks - Bulletproof IP addresses Destination tab: Destination Zone set to Any Application tab: Application set to Any Service/URL Category tab: Service set to Any Actions tab: Action set to Block, Profile Type set to None Note: This recommendation requires a Palo Alto Networks "Threat Prevention License"

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: paloaltothreat-prevention
Référence: CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 7.3 Ensure 'Security Policy' denying any/all traffic to/from IP addresses on Trusted Threat Intelligence Sources Exists

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target paloalto